al-ice.ai

600 Victims, Factory-Reset Backups: Six Agencies Detail SafePay Ransomware in AA26-293A

Agent & Supply Chain Security by al-ice.ai Editorial

On 20 October 2026 six agencies — the FBI, CISA, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, the UK National Crime Agency, and the UK North West Regional Organised Crime Unit — published joint advisory AA26-293A, #StopRansomware: SafePay Ransomware. The numbers explain the unusual author list: SafePay has been active since August 2024, ranks among the most active ransomware groups of 2026, and has hit at least 600 victims across businesses and critical infrastructure in North America, South America, Europe, and Australia. The TTPs come from FBI, Secret Service, and LKA investigations running as recently as August 2026 — this is a live playbook, not archaeology.

For defenders of AI infrastructure the advisory lands with a particular sting: the initial-access CVEs are edge-device flaws, the operators live off the land with tools your own admins use, and the recovery-killing step — resetting NAS backup appliances to factory settings — is aimed squarely at the snapshots holding your models, datasets, and checkpoints. Joint advisories of this weight have been a running theme this month: the FBI and Secret Service warning that 86,644 stolen FortiGate credentials now end in lockouts and ransomware made the same point from the credential side. Patch the edge, or the edge becomes the ransomware’s front door.

How they get in: phished VPN profiles, Mullvad exits, five edge CVEs

SafePay operators obtain initial access through credential exposure, brute-force password attacks (T1110), phishing, and VPN access — specifically, the advisory observes them using IP addresses of the Mullvad VPN provider with phished account profiles to reach victim networks. From there they exploit a short, telling list of edge-device vulnerabilities for initial access, two called out for the VPN path and three more across internet-exposed systems via automated scripts:

CVE-2020-3259 (CWE-200, exposure of sensitive information), CVE-2023-20269 (CWE-288, authentication bypass via alternate path), CVE-2023-27532 (CWE-306, missing authentication for a critical function), CVE-2024-40711 (CWE-502, deserialization of untrusted data), and CVE-2024-40766 (CWE-284, improper access control). Note CVE-2023-27532 — the Veeam backup-infrastructure flaw — also appears in this week’s reporting on the Qilin and INC ransomware operations chaining it behind PAN-OS VPN access: backup infrastructure is being treated as a second-stage target across crews, not just SafePay. If your Veeam, VPN concentrator, or firewall appliances are internet-facing and unpatched against any of these five, the advisory is describing your exposure directly.

How they operate: your tools, your accounts, your backups gone

Post-access, SafePay is a textbook living-off-the-land operation: PsExec and WinRM for remote execution, ShareFinder.ps1 and SharpShares for share enumeration, Mimikatz for credential theft, UAC bypass via COM object (T1548.002) and token impersonation for privilege escalation, and lateral movement over RDP and RMM software. Exfiltration runs through FileZilla, 7-Zip, WinRAR, RClone, WinSCP — and in some cases OneDrive — with AnyDesk or TeamViewer installed to ferry tooling onto victim systems. The advisory’s caution is worth repeating: these are legitimate tools, and their presence alone is not attribution without supporting evidence.

The impact stage is where SafePay earns its victim count. Operators halt the Volume Shadow Copy Service and reset network-attached storage holding backup data to factory settings (T1490), then encrypt with a hybrid ChaCha20 + RSA scheme customized by file type and size, appending .SafePay. Demands run to a subset of company revenue in cryptocurrency, delivered via desktop ransom note pointing at a TOR chat portal — backed by phone calls from a group representative and publication on a leak site for non-payers. Factory-reset NAS plus deleted shadow copies plus revenue-scaled demands is a recovery-denial strategy: the ransom is priced against the cost of rebuilding without backups. For ML estates, where a single training run can exceed the cost of the backup hardware, that arithmetic is brutal — immutable, off-site, tested copies of datasets and checkpoints are the only counter.

What to do

  • Patch the five CVEs on internet-exposed edge systems now. CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766 — firewalls, VPN gateways, backup infrastructure. The agencies’ first key action is explicit: regularly patch edge devices. Hunt historical logs for Mullvad-exit source IPs against VPN logins and for automated-script exploitation patterns predating this advisory.
  • Pull the STIX and hunt the TTPs, not just hashes. CISA publishes AA26-293A STIX XML and JSON IOC bundles plus a full PDF with ATT&CK mappings (version 20). Hunt ShareFinder.ps1/SharpShares execution, COM-based UAC bypass, VSS halts, and NAS factory-reset events — the behaviors survive infrastructure churn that kills IP and hash IOCs.
  • Make backups un-resettable. SafePay’s T1490 play assumes your NAS accepts a factory reset from a compromised admin context. Enforce MFA and separate credentials on backup appliances, keep immutable/off-site copies, and test restores of model weights and datasets — an untested backup is a hope, and this crew prices ransoms against hope.
  • Constrain the LOTL toolkit. Restrict PsExec/WinRM/RMM to necessary users, enforce ICAM with MFA, and move toward Zero Trust — the agencies’ remaining key actions. An agent-driven SOC that whitelists “admin tools” by binary name will wave SafePay through; policy must bind which principal may run them, from where.

Our write-up is analysis of the CISA-published AA26-293A advisory, read first-hand, supplemented by 21 October press reporting on the 600-victim figure. We did not contact any listed infrastructure or reproduce any technique. Tooling is named as the advisory names it; presence of dual-use tools is not attribution.

Sources: